13 Mar 2023
Euler V1: Missing Health Check on donateToReserves Enabled Self-Liquidation
Euler: on 13 Mar 2023 ~$197M was taken via a missing health check on donateToReserves. After weeks of negotiation, ~$240M was returned.
- Event date
- Incident typeSmart-contract exploit
- Bug classValidation
- Published
Loss, as sourced
About $197 million at attack time; approximately $240 million returned, per Euler Labs.
Traceability
Primary sources
In brief
Root cause: Per Euler Labs: donateToReserves lacked a health check, enabling donate-into-unhealthy then self-liquidation for a bonus larger than the donation.
Timeline, as sourced: 13 Mar exploit; recovery through early April; 100% return.
Account, as sourced
Claimed (Euler Labs) (account (opens in a new tab)): first-depositor patch introduced the function; audited but missing health check.
Summaries of public sources as of the published date; except where marked (on-chain), not independently verified by NullMeridian. Figures are the sources’ own and are attributed; where sources disagree, each is given. Sources may since have changed. Not legal, financial or investment advice.
Permalinkhttps://andromeda.observer/e/euler-donate-to-reserves-2023